@robelest/convex-auth 0.0.4-preview.29 → 0.0.4-preview.30

package/dist/server/signin.js

@@ -36,7 +36,11 @@ const describeUnknown = (value) => {
 	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint" || value === null) return String(value);
 	return JSON.stringify(value) ?? Object.prototype.toString.call(value);
 };
-const asConvexError = (error, code, message) => error instanceof ConvexError ? error : toConvexError(authFlowError(code, message));
+const asConvexError = (error, code, message) => {
+	if (error instanceof ConvexError) return error;
+	if (error instanceof Error) return toConvexError(authFlowError(code, error.message || message));
+	return toConvexError(authFlowError(code, `${message} ${describeUnknown(error)}`.trim()));
+};
 const asCredentialsError = (error) => {
 	if (error instanceof ConvexError) return error;
 	if (error instanceof Error) return new ConvexError({
@@ -55,14 +59,14 @@ async function signInFx(ctx, provider, args, options) {
 		hasRefreshToken: args.refreshToken !== void 0
 	}, async () => {
 		if (provider === null && args.refreshToken) try {
-			const tokens = await callRefreshSession(ctx, { refreshToken: args.refreshToken });
-			if (tokens === null) return {
+			const session = await callRefreshSession(ctx, { refreshToken: args.refreshToken });
+			if (session === null) return {
 				kind: "signedIn",
-				signedIn: null
+				session: null
 			};
 			return {
-				kind: "refreshTokens",
-				signedIn: { tokens }
+				kind: "signedIn",
+				session
 			};
 		} catch (error) {
 			throw asConvexError(error, "INTERNAL_ERROR", "Failed to refresh session.");
@@ -70,7 +74,7 @@ async function signInFx(ctx, provider, args, options) {
 		if (provider === null && args.params?.code !== void 0) try {
 			return {
 				kind: "signedIn",
-				signedIn: await callVerifyCodeAndSignIn(ctx, {
+				session: await callVerifyCodeAndSignIn(ctx, {
 					params: args.params,
 					verifier: args.verifier,
 					generateTokens: true,
@@ -114,7 +118,7 @@ async function handleEmailAndPhoneProviderFx(ctx, provider, args, options) {
 			if (result === null) throw toConvexError(authFlowError("INVALID_VERIFICATION_CODE", "Invalid or expired verification code."));
 			return {
 				kind: "signedIn",
-				signedIn: result
+				session: result
 			};
 		}
 		const alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
@@ -169,10 +173,7 @@ async function handleEmailAndPhoneProviderFx(ctx, provider, args, options) {
 		} catch {
 			throw toConvexError(authFlowError("INTERNAL_ERROR", "Failed to send phone code"));
 		}
-		return {
-			kind: "started",
-			started: true
-		};
+		return { kind: "started" };
 	});
 }
 async function handleCredentialsFx(ctx, provider, args, options) {
@@ -185,7 +186,7 @@ async function handleCredentialsFx(ctx, provider, args, options) {
 		}
 		if (result === null) return {
 			kind: "signedIn",
-			signedIn: null
+			session: null
 		};
 		const hintedHasTotp = result.hasTotp;
 		const preIssuedIssuance = result.issuance;
@@ -225,7 +226,7 @@ async function handleCredentialsFx(ctx, provider, args, options) {
 		if (preIssuedIssuance !== void 0) try {
 			return {
 				kind: "signedIn",
-				signedIn: await withSpan("convex-auth.signin.credentials.finalize", {
+				session: await withSpan("convex-auth.signin.credentials.finalize", {
 					generateTokens: options.generateTokens,
 					fromAuthorize: true
 				}, () => finalizeSessionIssuance(ctx.auth.config, {
@@ -248,7 +249,7 @@ async function handleCredentialsFx(ctx, provider, args, options) {
 		}
 		return {
 			kind: "signedIn",
-			signedIn: idsAndTokens
+			session: idsAndTokens
 		};
 	});
 }
@@ -268,7 +269,7 @@ async function handleOAuthProviderFx(ctx, provider, args, options) {
 			}
 			return {
 				kind: "signedIn",
-				signedIn: result
+				session: result
 			};
 		}
 		const redirect = new URL((readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL")) + `/api/auth/signin/${provider.id}`);

package/dist/server/sso/domain.d.ts

@@ -1,5 +1,5 @@
-import { ComponentCtx, ComponentReadCtx } from "../componentContext.js";
 import { ConvexAuthMaterializedConfig, GroupConnectionDeprovisionMode, GroupConnectionPolicy, GroupConnectionPolicyPatch, OIDCClaimMapping } from "../types.js";
+import { ComponentCtx, ComponentReadCtx } from "../componentContext.js";
 import { AuditEventRecord, ConnectionDomainRecord, GroupConnectionDomainLookupRecord, GroupConnectionListResult, GroupConnectionRecord, ScimConfigRecord, ScimIdentityRecord, WebhookDeliveryRecord, WebhookEndpointRecord } from "../contract.js";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
 

package/dist/server/telemetry.js

@@ -0,0 +1,58 @@
+import { authDb } from "./db.js";
+import { envOptionalString, readConfigSync } from "./env.js";
+
+//#region src/server/telemetry.ts
+function tokenIdentifierForUser(userId) {
+	const issuer = readConfigSync(envOptionalString("CONVEX_SITE_URL"));
+	return typeof issuer === "string" && issuer.length > 0 ? `${userId}${issuer}` : userId;
+}
+const AUTH_IDENTITY_ATTRIBUTE_KEYS = {
+	userId: "auth.user.id",
+	sessionId: "auth.session.id",
+	refreshTokenId: "auth.refresh_token.id",
+	email: "auth.user.email",
+	tokenIdentifier: "auth.token_identifier"
+};
+function projectIdentityValue(config, field, value) {
+	if (value === void 0) return;
+	const mode = config.telemetry?.includeIdentity ?? "none";
+	if (mode === "none") return;
+	if (mode === "hashed") return config.telemetry?.hashIdentity?.(value, field);
+	return value;
+}
+async function buildAuthIdentityAttributes(ctx, config, args) {
+	const fields = config.telemetry?.identityFields ?? {};
+	const mode = config.telemetry?.includeIdentity ?? "none";
+	if (mode === "none") return {};
+	const values = {
+		userId: args.userId,
+		sessionId: args.sessionId,
+		tokenIdentifier: tokenIdentifierForUser(args.userId)
+	};
+	if (args.refreshTokenId !== void 0) values.refreshTokenId = args.refreshTokenId;
+	if (fields.email) {
+		const user = await authDb(ctx, config).users.getById(args.userId);
+		if (typeof user?.email === "string") values.email = user.email;
+	}
+	const attributes = {};
+	for (const field of Object.keys(fields)) {
+		if (!fields[field]) continue;
+		const projected = projectIdentityValue(config, field, values[field]);
+		if (projected !== void 0) attributes[AUTH_IDENTITY_ATTRIBUTE_KEYS[field]] = projected;
+	}
+	if (Object.keys(attributes).length > 0) attributes["auth.identity.mode"] = mode;
+	return attributes;
+}
+async function buildRefreshIdentityAttributes(ctx, config, args) {
+	return await buildAuthIdentityAttributes(ctx, config, args);
+}
+async function buildSignInIdentityAttributes(ctx, config, args) {
+	return await buildAuthIdentityAttributes(ctx, config, args);
+}
+async function buildSignOutIdentityAttributes(ctx, config, args) {
+	return await buildAuthIdentityAttributes(ctx, config, args);
+}
+
+//#endregion
+export { buildRefreshIdentityAttributes, buildSignInIdentityAttributes, buildSignOutIdentityAttributes };
+//# sourceMappingURL=telemetry.js.map

package/dist/server/tokens.js

@@ -4,16 +4,26 @@ import { withSpan } from "./utils/span.js";
 import { SignJWT, importPKCS8 } from "jose";
 
 //#region src/server/tokens.ts
-const TOKEN_SUB_CLAIM_DIVIDER = "|";
 const DEFAULT_JWT_DURATION_MS = 1e3 * 60 * 60;
 const TOKEN_JTI_LENGTH = 24;
 const TOKEN_JTI_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 let cachedPrivateKeyPromise = null;
 let cachedIssuer = null;
 const JWT_ALG = "EdDSA";
+function normalizePkcs8Pem(value) {
+	const trimmed = value.trim();
+	if (!trimmed.includes("-----BEGIN PRIVATE KEY-----")) return trimmed;
+	const withEscapedNewlines = trimmed.replace(/\\n/g, "\n");
+	if (withEscapedNewlines.includes("\n")) return withEscapedNewlines;
+	const beginMarker = "-----BEGIN PRIVATE KEY-----";
+	const endMarker = "-----END PRIVATE KEY-----";
+	const body = trimmed.replace(beginMarker, "").replace(endMarker, "").trim().replace(/\s+/g, "");
+	if (body.length === 0) return trimmed;
+	return `${beginMarker}\n${body.match(/.{1,64}/g)?.join("\n") ?? body}\n${endMarker}`;
+}
 const getPrivateKey = () => {
 	if (cachedPrivateKeyPromise === null) try {
-		cachedPrivateKeyPromise = importPKCS8(requireEnv("JWT_PRIVATE_KEY"), JWT_ALG).catch((error) => {
+		cachedPrivateKeyPromise = importPKCS8(normalizePkcs8Pem(requireEnv("JWT_PRIVATE_KEY")), JWT_ALG).catch((error) => {
 			cachedPrivateKeyPromise = null;
 			throw error;
 		});
@@ -37,9 +47,19 @@ try {
 async function generateToken(args, config) {
 	const privateKey = await withSpan("convex-auth.tokens.import-key", { alg: JWT_ALG }, () => getPrivateKey());
 	const expirationTime = new Date(Date.now() + (config.jwt?.durationMs ?? DEFAULT_JWT_DURATION_MS));
-	return await withSpan("convex-auth.tokens.sign", { alg: JWT_ALG }, () => new SignJWT({ sub: args.userId + TOKEN_SUB_CLAIM_DIVIDER + args.sessionId }).setProtectedHeader({ alg: JWT_ALG }).setIssuedAt().setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET)).setIssuer(getIssuer()).setAudience("convex").setExpirationTime(expirationTime).sign(privateKey));
+	const claims = {
+		sub: args.identity.subject,
+		sid: args.identity.sessionId,
+		...args.identity.name !== void 0 ? { name: args.identity.name } : null,
+		...args.identity.email !== void 0 ? { email: args.identity.email } : null,
+		...args.identity.emailVerified !== void 0 ? { email_verified: args.identity.emailVerified } : null,
+		...args.identity.picture !== void 0 ? { picture: args.identity.picture } : null,
+		...args.identity.phoneNumber !== void 0 ? { phone_number: args.identity.phoneNumber } : null,
+		...args.identity.phoneNumberVerified !== void 0 ? { phone_number_verified: args.identity.phoneNumberVerified } : null
+	};
+	return await withSpan("convex-auth.tokens.sign", { alg: JWT_ALG }, () => new SignJWT(claims).setProtectedHeader({ alg: JWT_ALG }).setIssuedAt().setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET)).setIssuer(getIssuer()).setAudience("convex").setExpirationTime(expirationTime).sign(privateKey));
 }
 
 //#endregion
-export { TOKEN_SUB_CLAIM_DIVIDER, generateToken };
+export { generateToken };
 //# sourceMappingURL=tokens.js.map

package/dist/server/totp.js

@@ -1,4 +1,4 @@
-import { userIdFromIdentitySubject } from "./identity.js";
+import { getAuthenticatedUserIdOrNull } from "./identity.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
 import { authFlowError } from "../shared/errors.js";
@@ -64,14 +64,14 @@ function resolveTotpDispatch(params, verifier) {
 	};
 }
 async function requireAuthenticatedUserId(ctx) {
-	let identity;
 	try {
-		identity = await ctx.auth.getUserIdentity();
+		const userId = await getAuthenticatedUserIdOrNull(ctx);
+		if (userId === null) throw convexError("TOTP_AUTH_REQUIRED", "Sign in first, then set up two-factor authentication.");
+		return userId;
 	} catch (error) {
+		if (error instanceof ConvexError) throw error;
 		throw asConvexError(error, "INTERNAL_ERROR", String(error));
 	}
-	if (identity === null) throw convexError("TOTP_AUTH_REQUIRED", "Sign in first, then set up two-factor authentication.");
-	return userIdFromIdentitySubject(identity.subject);
 }
 /** @internal */
 const handleTotp = async (ctx, provider, args) => {
@@ -121,10 +121,12 @@ const handleTotp = async (ctx, provider, args) => {
 			}
 			return {
 				kind: "totpSetup",
-				uri,
-				secret: base32Secret,
-				verifier,
-				totpId
+				totpSetup: {
+					uri,
+					secret: base32Secret,
+					totpId
+				},
+				verifier
 			};
 		},
 		confirm: async () => {
@@ -152,7 +154,7 @@ const handleTotp = async (ctx, provider, args) => {
 			}
 			return {
 				kind: "signedIn",
-				signedIn: signInResult
+				session: signInResult
 			};
 		},
 		verify: async () => {
@@ -186,7 +188,7 @@ const handleTotp = async (ctx, provider, args) => {
 			}
 			return {
 				kind: "signedIn",
-				signedIn: signInResult
+				session: signInResult
 			};
 		}
 	}[dispatch.flow];

package/dist/server/types.d.ts

@@ -35,6 +35,44 @@ type AuthRoleDefinition = {
 type AuthAuthorizationConfig = {
   roles: Record<string, AuthRoleDefinition>;
 };
+/** Identity enrichment mode for auth telemetry spans. */
+type AuthTelemetryIdentityMode = "none" | "hashed" | "raw";
+/** Individual identity fields that can be attached to telemetry spans. */
+type AuthTelemetryIdentityFields = {
+  userId?: boolean;
+  sessionId?: boolean;
+  refreshTokenId?: boolean;
+  email?: boolean;
+  tokenIdentifier?: boolean;
+};
+/** Names of identity fields that can be attached to telemetry spans. */
+type AuthTelemetryIdentityField = keyof AuthTelemetryIdentityFields;
+/**
+ * Telemetry enrichment config for auth spans.
+ *
+ * Defaults to privacy-safe behavior with no identity fields attached.
+ */
+type AuthTelemetryConfig = {
+  /**
+   * Whether to include no identity values, hashed values, or raw values.
+   *
+   * @defaultValue "none"
+   */
+  includeIdentity?: AuthTelemetryIdentityMode;
+  /**
+   * Opt-in identity fields to attach to telemetry spans.
+   *
+   * Ignored when `includeIdentity` is `"none"`.
+   */
+  identityFields?: AuthTelemetryIdentityFields;
+  /**
+   * Required when `includeIdentity` is `"hashed"`.
+   *
+   * Use this to provide an application-defined hashing strategy for
+   * correlating auth spans without exposing raw identifiers.
+   */
+  hashIdentity?: (value: string, field: AuthTelemetryIdentityField) => string;
+};
 /**
  * Extracts the union of role ID strings from an authorization config.
  *
@@ -315,6 +353,13 @@ type ConvexAuthConfig = {
       grants: string[];
     }>;
   };
+  /**
+   * Optional OpenTelemetry enrichment for auth spans.
+   *
+   * Defaults to no identity attributes. Set `includeIdentity` to `"hashed"`
+   * or `"raw"` to opt into richer correlation.
+   */
+  telemetry?: AuthTelemetryConfig;
 };
 /**
  * Union of all supported auth provider config types.
@@ -841,7 +886,7 @@ type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> = Generi
  */
 type ConvexAuthMaterializedConfig = {
   providers: AuthProviderMaterializedConfig[];
-} & Pick<ConvexAuthConfig, "component" | "session" | "jwt" | "signIn" | "callbacks" | "authorization" | "sso">;
+} & Pick<ConvexAuthConfig, "component" | "session" | "jwt" | "signIn" | "callbacks" | "authorization" | "sso" | "telemetry">;
 interface SSOProfileMapping {
   subject?: string;
   email?: string;
@@ -1155,7 +1200,18 @@ type GenericDoc<DataModel extends GenericDataModel, TableName extends TableNames
 type AuthDataModel = DataModelFromSchemaDefinition<typeof _default>;
 /** A document from any table in the auth component schema. */
 type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<AuthDataModel, T>;
+/** Canonical identity claims mirrored into access tokens for Convex auth. */
+type SessionTokenIdentityClaims = {
+  subject: GenericId<"User">;
+  sessionId: GenericId<"Session">;
+  name?: string;
+  email?: string;
+  emailVerified?: boolean;
+  picture?: string;
+  phoneNumber?: string;
+  phoneNumberVerified?: boolean;
+};
 type KeyDoc = Infer<typeof vApiKeyDoc>;
 //#endregion
-export { AuthAuthorizationConfig, AuthGrant, AuthProviderConfig, AuthRoleId, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, GroupConnectionDeprovisionMode, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, KeyDoc, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PasskeyProviderConfig, PhoneConfig, PhoneUserConfig, SSOProviderConfig, ScopeChecker, TotpProviderConfig, UserOrderBy, UserWhere };
+export { AuthAuthorizationConfig, AuthGrant, AuthProviderConfig, AuthRoleId, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, GroupConnectionDeprovisionMode, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, KeyDoc, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PasskeyProviderConfig, PhoneConfig, PhoneUserConfig, SSOProviderConfig, ScopeChecker, SessionTokenIdentityClaims, TotpProviderConfig, UserOrderBy, UserWhere };
 //# sourceMappingURL=types.d.ts.map

package/dist/server/utils/span.js

@@ -44,7 +44,16 @@ async function withSpan(name, attributes, fn) {
 		}
 	});
 }
+/**
+* Attach attributes to the current active span when tracing is enabled.
+*/
+function setActiveSpanAttributes(attributes) {
+	if (!isTracingActive()) return;
+	const span = trace.getActiveSpan();
+	if (!span) return;
+	for (const [key, value] of Object.entries(attributes)) if (value !== void 0) span.setAttribute(key, value);
+}
 
 //#endregion
-export { withSpan };
+export { setActiveSpanAttributes, withSpan };
 //# sourceMappingURL=span.js.map

package/dist/shared/authResults.d.ts

@@ -0,0 +1,16 @@
+//#region src/shared/authResults.d.ts
+type AuthTokens = {
+  token: string;
+  refreshToken: string;
+};
+type DeviceCodePayload = {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresIn: number;
+  interval: number;
+};
+//#endregion
+export { AuthTokens, DeviceCodePayload };
+//# sourceMappingURL=authResults.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robelest/convex-auth",
-  "version": "0.0.4-preview.29",
+  "version": "0.0.4-preview.30",
   "description": "Authentication for Convex",
   "keywords": [
     "auth",
@@ -27,7 +27,10 @@
     "!dist/schema.d.ts.map"
   ],
   "type": "module",
-  "sideEffects": false,
+  "sideEffects": [
+    "./src/server/convexIdentity.ts",
+    "./dist/server/convexIdentity.js"
+  ],
   "exports": {
     "./_generated/component.js": {
       "types": "./dist/component/_generated/component.d.ts"
@@ -118,7 +121,7 @@
     "@oslojs/encoding": "^1.1.0",
     "@oslojs/otp": "^1.1.0",
     "@oslojs/webauthn": "^1.0.0",
-    "@robelest/samlify": "workspace:*",
+    "@robelest/samlify": "^0.0.1-preview.2",
     "arctic": "^3.7.0",
     "cookie": "^1.1.1",
     "fluent-convex": "^0.12.3",

package/dist/server/constants.js

@@ -1,6 +0,0 @@
-//#region src/server/constants.ts
-const TOKEN_SUB_CLAIM_DIVIDER = "|";
-
-//#endregion
-export { TOKEN_SUB_CLAIM_DIVIDER };
-//# sourceMappingURL=constants.js.map